8
labels Any statement can be preceded by a label. The label can be used as a destination of a goto or can be used in a remote reference. Label names must be unique. Any number of labels can be attached to a single statement. active proctype P() { S0: S1:do :: q!p -> S2: q?v :: true od /* S3 */ }

9
Remote reference use for testing the local control state of an active process We can check whether two user process are in the critical state user[1]@critical && user[2]@critical use for testing the value of a local variable in an active process We can refer to the variable count in process Dijkstra Dijkstra : count Normally reserved for use in never claim (see later) mtype {p,v} chan sema = [0] of {mtype} active proctype Dijkstra (){ byte count=1; do :: (count==1)-> sema!p; count=0 :: (count==0)-> sema?v; count=1 od } active [3] proctype user(){ do :: sema?p; critical: skip; sema!v; od }

13
Progress states Mark statements in the model that accomplish something. require that the progress labels will be visited infinitely often in any infinite system execution. Any violation of this requirement can be reported by the verifier as a non-progress cycle.

22
Inline-חוב מן העבר An inline definition works much like a preprocessor macro An inline definition must appear before its first use, and must always be defined globally. An invocation (an inline call) is performed with a syntax that is similar to a procedure call in C, but it does not define a new variable scope a inline cannot return a value to the caller. An inline definition may itself contain other inline calls, but it may not call itself recursively.